About sabi4evr_com

Yes, it happened. The primary PA FW was crashed and we couldn't recover. We had a huge network outage, it all happened with a faulty network switch which continuously sends the topology change packets to the entire network resulting in a network loop. At some point the FW was not responding, did a reboot after the backup. It never came back, the status lights were off except the power light. Even nothing from the console port as well, no messages or boot information showed up.   Luckily we had the PA OSS device. This is what we did.   1. Raised a case with the support at the highest priority 2. We powered on the OSS device and confirmed the PAN OS version 3. There was a version difference between these 2 devices 4. Downloaded the base PAN OS and the updates to match the version of PAN OSS to the live unit 5. With the help of mgmt port, updated the OS of OSS unit 6. Restored latest backup to the OSS unit 7. We did received some errors during the restoration, I believe those were some Firewall security rules, which was easy to troubleshoot 8. The support guys came into the scenario 9. For some reason, the OSS unit was not showing in device list. May be it wasn't added during the time of purchase 10. They added the unit with the SN # information 9. Downloaded the latest AV, URL, GP, Clientless VPN and other licenses from the portal and restored to the OSS unit 10. Removed the existing license information of faulty unit from the Portal 11. Assigned the license to the OSS unit and renamed the Unit to Production one 12. All services were restored 13. RMA was issued, but it took 2 weeks or so 14. The core team was unable to analyze the firewall as it was completely given up   The overall process might have taken 2-3 hours. As we were doing this for the first time on working hours it was a difficult one. Having the support engineer on the right time saved us a big time or else we could have spend more hours figuring out on how to transfer the licenses.  ... View more

Did you give a try in downloading and import the Threat license from the palo alto customer portal? If not, just give a try. Try the below methods to download the same. 1. login to customer support 2. Go to assets 3. Select devices 4. Download the Threat Prevention License I think the OSS should also have all the latest dynamic updates as well.   ... View more

I am not sure on the below. I have never tried to import the device state to the OSS unit as I was afraid that having the same configuration on 2 devices might have some impact on the network. I don't have a test network as well, so I didn't tried. So, far I am just backing up all the device backups on a monthly basis. What I know is that during that a device failure, we will need the PA support assistance in transferring the current PA licenses to the OSS unit. ... View more

Dear Abdul,    Am I mentioning the below in the configuration steps correctly? This is based on my idea so far. Please correct me if I am wrong.   STAGE 1 1. create agg grp 2. assign interface name (ae1) 3. interface type - Layer 3 4. config- virtual router > default security zone > Internal Zone 5. IPv4 - assign the static IP for this group 6. enable LACP 7. maximum interfaces? keep it 2? as only 2 interfaces will be used for this purpose? 8. Advanced - Other info > Management Profile > Select the management profile STAGE 2 1.Configure a new interface 2. Select aggregate group - ae1 3. leave the advanced settings to the default options ... View more

Dear Abdul,   Thanks for the update. Both switches are in stack. For my case can you please guide me through step by step for this configuration. Currently port #1 is configured and is connected with Cisco core switch. This port interface type is L3.   Do i need to create a similar interface configuration on port 3 for the second switch? And then proceed to the 'Add Aggregate Group'?   ... View more